63d298ff04abdc608e60a583bbd9b52558f32cb6434817484e8846b5ec3bdfd1

Analysis

max time kernel
110s
max time network
95s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63d298ff04abdc608e60a583bbd9b52558f32cb6434817484e8846b5ec3bdfd1N.exe
Size

83KB
MD5

cb2c079456919c5b97be9f1eddd97fa0
SHA1

90a6fb396c757e5bd8cc6ae3977dde4318660c5f
SHA256

63d298ff04abdc608e60a583bbd9b52558f32cb6434817484e8846b5ec3bdfd1
SHA512

c94ab3604f545e926f42fe0084a177d0fad74b8505b49fe6fd822950f33762a08e47b7d9a4a40159a0feedb066e53d4609f684395453916a399b2a6bffd9d16a
SSDEEP

1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+/K:LJ0TAz6Mte4A+aaZx8EnCGVu/

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2792-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2792-1-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2792-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0033000000017474-12.dat	upx
behavioral1/memory/2792-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2792-22-0x0000000000400000-0x000000000042A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63d298ff04abdc608e60a583bbd9b52558f32cb6434817484e8846b5ec3bdfd1N.exe

C:\Users\Admin\AppData\Local\Temp\63d298ff04abdc608e60a583bbd9b52558f32cb6434817484e8846b5ec3bdfd1N.exe
"C:\Users\Admin\AppData\Local\Temp\63d298ff04abdc608e60a583bbd9b52558f32cb6434817484e8846b5ec3bdfd1N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rifaien2-tDOWft3BEGeTSDbn.exe

Filesize
83KB

MD5
8523d529e0d4213e703ecdb0d4a84d71

SHA1
c41fd9607a6d765af2010f51d1c43d3b8730fae0

SHA256
b5594a5762fc02a084fc05cd94c7d45f61785a2a4d22eb685155c38dbcdfc3aa

SHA512
5324894599982912c8228e4949e7f15b757cde2fd3abfc7248fdfec656231bf31cab4b1cabd4de909dd0c39c5f617ce4788af2787287817d8c668842aa2e260f

Download Submit
memory/2792-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2792-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2792-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2792-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2792-22-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download